From 615f6615e07e6f15cb4d3bc0ff3a772c2282fe7b Mon Sep 17 00:00:00 2001
From: Ruslan Bakiev <572431+veikab@users.noreply.github.com>
Date: Thu, 20 Aug 2026 18:51:14 +0700
Subject: [PATCH] Authorize default client team context

---
 src/auth.ts | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/src/auth.ts b/src/auth.ts
index 6a60c84..5a19df7 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -79,6 +79,12 @@ function scopesFromPayload(payload: JWTPayload): string[] {
   return [];
 }
 
+function clientScopes(payload: JWTPayload): string[] {
+  return [
+    ...new Set([...scopesFromPayload(payload), "teams:user", "teams:member"]),
+  ];
+}
+
 function claimList(payload: JWTPayload, key: string): string[] {
   const value = (payload as Record<string, unknown>)[key];
   if (typeof value === "string") return value.split(" ");
@@ -115,12 +121,14 @@ export async function teamContext(req: FastifyRequest): Promise<AuthContext> {
     audience: LOGTO_ORDERS_AUDIENCE,
   });
 
-  const teamUuid = (payload as Record<string, unknown>).team_uuid as
-    | string
-    | undefined;
-  const scopes = scopesFromPayload(payload);
+  const claimedTeamUuid = (payload as Record<string, unknown>).team_uuid;
+  const teamUuid =
+    typeof claimedTeamUuid === "string" && claimedTeamUuid.length > 0
+      ? claimedTeamUuid
+      : payload.sub;
+  const scopes = clientScopes(payload);
 
-  if (!teamUuid || !scopes.includes("teams:member")) {
+  if (!payload.sub || !teamUuid) {
     throw unauthenticated();
   }